1. Technical Field
This disclosure relates to electronic financial transactions in general, and more particularly, to methods and systems for biometric authentication of financial transactions by a trusted service manager (TSM).
2. Related Art
“Contactless technology” refers to short distance communications between two devices that are not physically connected. A wide variety of contactless technology exists today. Near Field Communication (NFC) is a specific type of contactless technology that is of high importance to Mobile Network Operators (MNOs) and to Service Providers (SPs), such as banks, credit card issuers and other payment service providers. NFC is a short-range, high frequency, wireless, RF communication technology that enables the exchange of data between devices typically over about a 10 centimeter (or about 4 inches) distance, thus providing a fast, simple and secure way for a user to effect a wide range of contactless services with a mobile device, such as a mobile telephone or personal digital assistant (PDA).
One example of an NFC technology application is financial transactions. NFC mobile devices and other types of contactless devices, such as radio frequency-enabled credit/debit cards, key fobs, and the like are experiencing rapid growth worldwide in various industries, including transportation, retail, parking and other industries, that will now accept NFC mobile payments and other types of contactless payments.
As an example, wireless mobile devices that include an NFC device and a smart card, which can use radio frequency identification (RFID) technology for identification purposes, can enable a person to effect a simple financial transaction, such as the purchase of a retail item, in a convenient, secure manner. Typically, a consumer waves the wireless mobile NFC device near a “reader” to effect a monetary transfer, and the purchase price of the item is deducted from a total amount that is available and stored on a “smart card” of the wireless mobile device. Optionally, the amount of the item can be forwarded to a server that can identify the purchaser through a unique identification code of the purchaser and then subsequently debit a credit or deposit account of the purchaser appropriately for the purchase of the retail item. Such NFC-based point of sale (POS) transactions provide several advantages, such as eliminating the need to carry cash and enabling faster, more convenient and secure financial transactions.
Because customers are interested in being able to use their mobile devices for contactless services, a new mobile NFC “ecosystem,” illustrated in FIG. 1, has been defined by the Global System for Mobile communication Association (GSMA), which is a global trade association representing over 700 GSM mobile phone operators throughout the world. (See, e.g., “Mobile NFC Services,” GSMA, Version 1.0, February 2007). As illustrated in FIG. 1, such ecosystems involve a variety of different players or entities and new roles for such players, including:                Customer—the customer is a customer of a merchant and subscribes to a Mobile Network Operator (MNO) and a service provider.        MNO—the MNO provides a full range of mobile services to the Customer, and can also provide Universal Integrated Circuit Cards (UICCs) and NFC terminals, plus Over the Air (OTA) transport mechanisms.        Service Provider (SP)—the SP provides contactless services to the Customer. Examples of SPs include banks, credit card issuers as well as public transport companies, loyalty programs owners, and the like.        Retailer/Merchant—the retailer/merchant can operate an NFC capable point of sale (POS) terminal.        Trusted Service Manager (TSM)—the TSM securely distributes and manages NFC applications and can have, for example, a direct or an indirect relation to the SPs, e.g., via clearing houses, such as the Automated Clearing House (ACH), the Electronic Payment Network (EPN) or the Visa/MasterCard network.        Handset, NFC Chipset and UICC Manufacturers—the Manufacturers produce mobile NFC/communication devices and the associated UICC hardware.        Reader Manufacturer—the reader manufacturer makes NFC reader devices.        Application Developers—the application developers design and develop mobile NFC applications, including financial transaction applications.        Standardization bodies and industry associations—develop global standards for NFC that enable interoperability, backward compatibility and future development of NFC applications and services.        
As will be appreciated, successful implementation of NFC technologies requires cooperation between the many disparate players of the GSMA ecosystem. Each player can have its own expectations, for example, the Customer expects convenient, friendly and secure services within a trusted environment; the SPs want their applications to be housed and used in as many mobile devices as possible; and the MNOs want to provide new mobile contactless services that are secure, of high quality and consistent with the existing services experienced by the Customer. But although each player can have its own culture and expectations, they all have the same basic requirement, viz., the need for security and confidentiality.
The Trusted Service Manager (TSM), in particular, brings trust and convenience to the complex, multi-player NFC ecosystem. The TSM role includes providing a single point of contact for the SPs, e.g., banks, to access their respective customer bases through the MNOs, and to secure download and lifecycle management for mobile NFC applications on behalf of the SPs. It should be understood that the TSM does not disrupt the SP's business model, as the TSM does not participate directly in the transaction stage of the service, but rather, only indirectly.
In addition to NFC based POS payments, there are a number of other payment models currently prevalent in the mobile industry including:                (i) Short Message Service (SMS)—SMS is a communications protocol that allows the interchange of short text messages between mobile devices; and,        (ii) Mobile Internet-based payments—Customers routinely search for and purchase products and services through electronic communications with online merchants over electronic networks, such as the Internet.        
Regarding the latter, individual customers may frequently engage in transactions with a variety of merchants through, for example, various merchant websites. Although a credit card can be used for making payments over the Internet, a disadvantage of online credit card usage is that online merchants can be exposed to high fraud costs and “chargeback fees” because there is no credit card authentication signature with an online sale.
In the case of in-person POS payments made with payment cards, such as with Master Cards or Visa cards in the U.S., or a “Chip and PIN” card in the U.K., current authentication is by means of the purchaser's provision of a signature or a personal identification number (PIN).
Accordingly, systems and methods are needed for authenticating NFC based POS transactions securely and reliably without the need for signatures or PINs, and more particularly, for authentication of POS transactions using a biometric trait, such as a fingerprint, that can be input via a data communication device of the user, e.g., the user's mobile phone.